an interesting French case on whether mandatory breach reporting precludes subsequent sanctions (an important topic given breach reporting under the GDPR). Spoiler alert: The Council of State rejected this argument.